Cryptography is the practice and study of logical means used to achieve information confidentiality, integrity and authenticity. It covers, among other things, encryption (making some data unreadable except for those who know a given secret element, called a key), data hashing (in particular for ...
0
votes
0answers
18 views
Why this k parameter is in unary in adversary PPT algorithm? [migrated]
While reading some text on cryptography, I found that algorithm A, that the adversary (called Eve by convention) runs to break the cipher message, needs two parameters, candidate message (y) and ...
15
votes
2answers
300 views
Homomorphic encryption used for e-voting?
I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused:
"The homomorphic property of various cryptosystems can be used to
create secure voting systems, ..."
...
7
votes
2answers
1k views
Data Encryption and Key Management in C#
Which route to take, what are the pros and cons, which is more secure..
Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES ...
6
votes
2answers
68 views
Backup schedule for Encryption Keys
How often should encryption keys be backed up?
Should this be done on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often.
Perhaps ...
2
votes
2answers
32 views
Does glibc2 version of the crypt function still use DES for alternative hashing methods?
I'm trying to understand how typical Linux distributions generate the password field for entries in /etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted ...
66
votes
16answers
15k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
5
votes
3answers
1k views
Vigenere Cipher - help with decryption (by hand)
So this is a Vigenere cipher-text
EORLL TQFDI HOEZF CHBQN IFGGQ MBVXM SIMGK NCCSV
WSXYD VTLQS BVBMJ YRTXO JCNXH THWOD FTDCC RMHEH
SNXVY FLSXT ICNXM GUMET HMTUR PENSU TZHMV LODGN
MINKA DTLOG HEVNI ...
20
votes
2answers
967 views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
3
votes
3answers
356 views
Pseudo Random Generator is not initialized from the (entropy pool)?
The RHEL5 manuals state that /dev/urandom will use the entropy pool until it's exhausted, and then it will resort to a fall-back pseudo-random algorithm, so that it will never block.
But when ...
4
votes
3answers
188 views
Is it okay to sign a PGP key without an IRL meeting?
[PGP] can get paralyzed by excessive analness.
— Phil Zimmermann
Preamble
I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
23
votes
3answers
14k views
What is the difference between SSL vs SSH? Which is more secure?
What is the difference between SSH and SSL? Which one is more secure, if you can compare them together?
Which has more potential vulnerabilities?
3
votes
1answer
98 views
Recognizing PGP-encrypted disks
I am studying various disk encryption schemes (such as PGP, MS Bit Locker, BestCrypt and TrueCrypt) on my Windows OS.
I am interested to know how an encrypted partition/disk/file with a particular ...
6
votes
1answer
115 views
Do the new instruction sets found on Intel's Haswell Architecture make any difference in cryptographic operations?
Intel's Haswell architecture has support for several new Bit Manipulation Instructions. In Intel's own words,
Bit manipulation instructions are useful for compressed database, hashing , large ...
-1
votes
1answer
170 views
What is a man in the middle attack?
My university provided me with the following slide which is confusing me:
From my understanding, what is happening here is that Trudy (Person in the middle) is pretending to be Alice. Bob then ...
-3
votes
0answers
92 views
Decrypt my cookie [closed]
Would anybody -with the right experience- point me to the encryption, encoding, hash this number: ah0nr6721epbph2tts2i0bttd2 is stored as -if it is at all. It's a PHP session cookie.
2
votes
0answers
53 views
Knowing a valid salted hash for an unknown secret, is it possible to compute another valid hash? [migrated]
H(s,r)=d is a function that hashes the string s with a salt r, giving the result d.
Hashing functions are not injective, so there isn't a reverse function H'(d,r)=s.
Therefore to prove that d is a ...
5
votes
6answers
799 views
Prevent denial of service attacks against slow hashing functions?
I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
3
votes
5answers
321 views
The security level in hash function
What is the difference in security between using part of message digest hash function or all the message digest hash function? and is there any equation can calculate the security for part or whole ...
17
votes
9answers
3k views
Do secure phone lines exist?
I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure .
I know that Skype and other VOIP service providers have to ...
3
votes
1answer
81 views
Windows Phone and Hardcoding Values
Let us say that I have a Windows Phone application. If I hardcode a private key in the Windows Phone application, can people extract it once the application is released to the public on the Windows ...
2
votes
1answer
64 views
How to Verify the Identity of the Caller of a Web Service
I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.
Now, my question is, how do I ...
114
votes
11answers
14k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
1
vote
1answer
65 views
SSL Communication and Proxy
Let us say that I have a client and a server communicating using SSL.
If a hacker sets up a proxy between the client and the server, will he be able to decrypt the data which is being sent?
1
vote
1answer
61 views
Symmetric Key Cryptography vs Public Key Cryptography [duplicate]
I understand what the two are so need to go into detail about that, however what I'm curious about is in what kind of situations would we use one over the other? It feels to me as if Public Key ...
0
votes
1answer
64 views
Determine the Identity of Caller
Let me explain my situation.
I have a provider which is made up of a registration page and a web service. Online vendors (clients) register with the provider by providing details such as username, ...
-7
votes
1answer
58 views
Asymmetric encryption algorithms [closed]
What are the best asymmetric encryption algorithms out there? I am trying to use RSA in my project howoever I have read that it is not quite secure as other asymmetric encryption algorithms.
10
votes
2answers
184 views
What are the practical uses of large asymmetric keys?
The Windows CNG supports keys of varying sizes, e.g. RSA up to 16384 bits: http://msdn.microsoft.com/en-us/library/windows/desktop/bb204778(v=vs.85).aspx.
My understanding is that in crypto today we ...
2
votes
1answer
40 views
Sending Digital Certificates
I used the makecert tool in order to create:
a self-signed certificate
a server certificate using the self-signed certificate
a client certificate using the self-signed certificate
I then ...
6
votes
1answer
1k views
Is SSL key generation client-side, server-side, or both?
Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?
3
votes
1answer
51 views
Clarification on Digital Certificates
I used the makecert tool to create:
self-signed certificate
client certificate
These are the commands I used:
makecert -n "CN=MatthewCA" -r -sv MatthewCA.pvk MatthewCA.cer **for self signed ...
2
votes
1answer
60 views
Hash extension(padding) attack
I recently came across this website talking about sha1 padding attack.
http://www.vnsecurity.net/2010/03/codegate_challenge15_sha1_padding_attack/
After reading here are some of my doubts:
How ...
2
votes
1answer
61 views
Security Certificates - Tools to Generate Security Certificates
I want to create a self-signed certificate that will be installed as a trusted certificate authority.
I then want to create another two certificates which are signed using the private key of the ...
3
votes
1answer
132 views
How to determine hashes/second in password cryptanalysis
I'm working on my dissertation concerning cryptanalysis on password hashes. As part of my research, I aim to crack a number of passwords with John the Ripper and rainbowcrack-mt.
I'd like to ...
1
vote
1answer
83 views
The request was aborted: Could not create SSL/TLS secure channel Exception
Let me explain my situation.
I created a self-signed certificate and installed it in the Trusted Root Certification Authorities section in MMC.
I then created two certificates using the self-signed ...
0
votes
0answers
7 views
Why SecureRandomSpi or other SPI (Service Provider Interface) in java security are abstract not interface? [migrated]
SecureRandomSpi is Service Provider Interface. All the abstract methods in this class must be implemented by each service provider who wishes to supply the implementation of a cryptographically strong ...
3
votes
4answers
225 views
Is it possible to configure any of wifi protocols so that the network is undetectable?
I am wondering if it possible to configure my DD-WRT router so that the wifi network I am using is undetectable - impossible to tell if there is any network broadcasting even if there are clients ...
4
votes
1answer
85 views
Switching to new encryption method (without losing data?)
Let's say you have a website that provides a service of some kind. Users can log in, they can store some kind of data, and there's various types of encryption in place to keep it all safe. Passwords ...
8
votes
3answers
2k views
What are the risks of self signing a certificate for SSL
Let's say I sign a SSL certificate for myself, and I'm not using a certified CA. What are the risks and/or threats of doing it?
20
votes
7answers
3k views
Where to get an SSL certificate for personal website?
I would like to use https to login to my personal webpage (which is on shared hosting). So I went over to google and started searching for sollutions. Eventualy I found out that I need an SSL ...
3
votes
3answers
468 views
Diffie Hellman - how large should the random number be?
When using the Diffie Hellman exchange with the second Oakley group 1024 bit Prime per RFC 2409 (*), how large should the random numbers generated by both sides be?
In RFC 2631 this is called the ...
14
votes
8answers
607 views
Is advanced mathematics relevant to security beyond cryptography?
Short question. The title says it all... is advanced mathematics (i.e. beyond the classic college level calculus sequence) relevant to any field of computer security besides cryptography? By relevant, ...
16
votes
3answers
4k views
Is SHA1 better than md5 only because it generates a hash of 160 bits?
It is well known that SHA1 is recommended more than md5 for hashing since md5 is practically broken as lot of collisions have been found.
With the birthday attack, it is possible to get a collision ...
7
votes
4answers
643 views
Generate cryptographically strong pseudorandom numbers in Javascript?
Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript?
The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
25
votes
8answers
2k views
Why would salt not have prevented LinkedIn passwords from getting cracked?
In this interview posted on Krebs on Security, this question was asked and answered:
BK: I’ve heard people say, you know this probably would not have
happened if LinkedIn and others had salted ...
4
votes
3answers
99 views
What SSL options should not be used?
What SSL options should be avoided, due to recently discovered weaknesses? This might include symmetric algorithms, or MAC functions.
2
votes
1answer
93 views
Cryptography Online Education
Do the security experts at IT Security have a preference between the two cryptography courses offered by Coursera (Stanford), "Cryptography I" and Udacity, "Applied Cryptography"?
I am seeking an ...
43
votes
3answers
16k views
What's the difference between SSL, TLS, and HTTPS?
I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
6
votes
2answers
608 views
Stretching a hash, many iterations versus longer input string
I have been reading up on various password hashing schemes, for example the SHA-based Crypt proposed by Ulrich Drepper and used in some Linux versions.
A recurring theme here is to 'strengthen' or ...
-5
votes
3answers
369 views
create a variants of MD5
I have also asked similar q here :
To create a variants of MD5, I made following changes :
MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32)
Instead ...
0
votes
1answer
216 views
any small idea to decode this algortihm from php script [closed]
So I think the algorithm is based on the php function ENCODING_decode defined in includes/encoding.php (which i don't have) .
The encoded result $xId_campaign_encoded from the php script has ...
